From what I gathered, the phishing never got as far as accessing the market account so his cashout is legitimate.